<html>
<head><meta charset="utf-8"><title>Never allow unwinding from Drop impls · t-lang · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/index.html">t-lang</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html">Never allow unwinding from Drop impls</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="242125527"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242125527" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242125527">(Jun 09 2021 at 20:31)</a>:</h4>
<p><a href="https://github.com/rust-lang/lang-team/issues/97">https://github.com/rust-lang/lang-team/issues/97</a> was posted by Josh T.</p>



<a name="242125902"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242125902" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242125902">(Jun 09 2021 at 20:34)</a>:</h4>
<p>I'm quite honestly baffled at the proposal because I don't see how this can done in a backwards compatible way. Even if it's changed in a new edition then code would have to cope with potentially something from an old edition still being involved.</p>



<a name="242126027"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242126027" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242126027">(Jun 09 2021 at 20:35)</a>:</h4>
<p>And I know that this is intentionally done from time to time. For example, some graphics crates for Vulakn-style APIs will panic in debug mode if a handle is dropped rather than disposed of properly.</p>



<a name="242126535"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242126535" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242126535">(Jun 09 2021 at 20:38)</a>:</h4>
<p>To be clear, I'm <em>not</em> proposing that we can change this universally.</p>



<a name="242126736"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242126736" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242126736">(Jun 09 2021 at 20:40)</a>:</h4>
<p>Rather, we could potentially plan a transition in which all <em>new</em> code can't rely on this. We could, as one possible path, introduce a variant of <code>panic=unwind</code> that doesn't allow unwind from drop impls, and eventually make that the default. Then, crates would have to explicitly change their panic strategy if they want to allow unwind-from-Drop.</p>



<a name="242126800"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242126800" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242126800">(Jun 09 2021 at 20:40)</a>:</h4>
<p>And at some point, this may thus become rare enough that it's safe for code to just say "this crate doesn't support being compiled with unwind-from-Drop allowed".</p>



<a name="242126989"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242126989" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242126989">(Jun 09 2021 at 20:42)</a>:</h4>
<p>That sounds good but also makes me think thay there should be a way to say that in a crate's code and not just in the Cargo.toml</p>



<a name="242126991"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242126991" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242126991">(Jun 09 2021 at 20:42)</a>:</h4>
<p>There are also mitigation strategies we could use in concert with the library team, such as automatically wrapping any object received via <code>catch_unwind</code> such that its <code>Drop</code> implementation is wrapped in <code>catch_unwind</code> and then just gets <code>mem::forget</code> called on it if it attempts to unwind-from-Drop.</p>



<a name="242127296"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242127296" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242127296">(Jun 09 2021 at 20:45)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> Thanks for raising the need for clarification. I posted <a href="https://github.com/rust-lang/lang-team/issues/97#issuecomment-858087744">https://github.com/rust-lang/lang-team/issues/97#issuecomment-858087744</a> to capture that in-thread.</p>



<a name="242127673"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242127673" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242127673">(Jun 09 2021 at 20:48)</a>:</h4>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="cp">#[cfg(not(panic_style=</span><span class="s">"not-in-drop"</span><span class="cp">))]</span><span class="w"></span>
<span class="fm">compile_error!</span><span class="p">(</span><span class="s">"this crate requires that drop cannot panic"</span><span class="p">);</span><span class="w"></span>
</code></pre></div>



<a name="242129678"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242129678" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242129678">(Jun 09 2021 at 21:03)</a>:</h4>
<p>Something along those lines, sure.</p>



<a name="242129723"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242129723" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242129723">(Jun 09 2021 at 21:03)</a>:</h4>
<p>(The same way that crates should be able to say "I <em>require</em> panic unwind, and don't support panic abort", or vice versa.)</p>



<a name="242184865"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242184865" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242184865">(Jun 10 2021 at 10:17)</a>:</h4>
<p>Tbf, I'm not fond of that approach, if it can't be made universal: <em>library</em> code using <code>catch_unwind</code> will still need to take into account the cases where a downstream user may not disable panics in drops. So using a cfg like <span class="user-mention" data-user-id="224471">@Lokathor</span> has done, then becomes mandatory, which means library authors would need to be aware of the issue: <strong>we are back to square one</strong> (except for the cfg being a bit easier to write than setting up an abort-on-panic guard before dropping the panic payload).</p>



<a name="242187607"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242187607" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242187607">(Jun 10 2021 at 10:47)</a>:</h4>
<p>Panic on drop is a huge mess. Even if we are able to handle it soundly in std collections like Vec, it still causes memory leaks since we don't continue dropping elements and freeing the underlying memory after a drop has panicked.</p>



<a name="242187727"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242187727" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242187727">(Jun 10 2021 at 10:49)</a>:</h4>
<p>It's also tricky to handle soundly: in the past <code>smallvec</code> and <code>arrayvec</code> have been unsound when faced with panicking drops. They are fixed now, although they still leak memory.</p>



<a name="242187847"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242187847" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242187847">(Jun 10 2021 at 10:50)</a>:</h4>
<p>I personally feel that panic-on-drop is an anti-feature: you really shouldn't be relying on it, and if you are then you should transition away from it ASAP. Making drops abort on panic will help with this transition.</p>



<a name="242188010"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242188010" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242188010">(Jun 10 2021 at 10:52)</a>:</h4>
<p>In the Vulkan example mentioned by <span class="user-mention" data-user-id="224471">@Lokathor</span>, this is essentially a debugging helper. It would work just as well as an abort rather than as an unwind. Note that the panic message is still printed during an abort, it's just that we refused to unwind past the drop.</p>



<a name="242192972"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242192972" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242192972">(Jun 10 2021 at 11:45)</a>:</h4>
<p>Sorry I should have clarified: I don't think that <em>almost always</em> preventing unwinding from drops is really gonna help that much <em>w.r.t.</em> the related <code>catch_unwind</code> issue, as I mentioned, since the fact this doesn't happen 100% of the cases means special handling is still required, as is the special handling for <code>smallvec</code> and <code>arrayvec</code>. Should the change happen <em>always</em>, then that's another story, but I can imagine how that feature could somehow be relied on by some specific crate (obviously a crater run and other investigation would be required to avoid these speculative assumptions). And I personally do agree that expecting a panic in a drop impl to be recoverable (because this is what the question is all about, since, as you mentioned, the panic hook still gets called before the abort) seems oddly niche, and leads to many footguns. So I am not against the approach <em>per se</em>, I am just skeptical of its usefulness to act as a real anti-footgun tool should it not be made universal, and I agree with <span class="user-mention" data-user-id="224471">@Lokathor</span>'s concerns that making it universal is, <em>potentially</em>, problematic on its own.</p>



<a name="242211491"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242211491" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242211491">(Jun 10 2021 at 14:05)</a>:</h4>
<p>I am personally in favor of making it universal, for the reasons I stated above.</p>



<a name="242243673"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242243673" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242243673">(Jun 10 2021 at 17:40)</a>:</h4>
<p>im wondering if there's a missing language feature (other than linear types) that is motivating most of these panic-on-drop types</p>



<a name="242243784"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242243784" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242243784">(Jun 10 2021 at 17:41)</a>:</h4>
<p>like, I'm agreeing that it's an anti feature but I'm curious what holes in the lang we're leaving / expanding by removing it</p>



<a name="242243945"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242243945" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242243945">(Jun 10 2021 at 17:42)</a>:</h4>
<p>I wouldn't be surprised if it's often just "I need to call a close function and that function can return an error".</p>



<a name="242244118"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242244118" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242244118">(Jun 10 2021 at 17:43)</a>:</h4>
<p>I think that's kinda just describing linear types again</p>



<a name="242244205"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242244205" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242244205">(Jun 10 2021 at 17:44)</a>:</h4>
<p>"I need to make sure this resource is disposed of properly and errors handled"</p>



<a name="242244255"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242244255" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242244255">(Jun 10 2021 at 17:44)</a>:</h4>
<p>I should go reread gankra's post on linear types to remind me why they're bad</p>



<a name="242255266"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242255266" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242255266">(Jun 10 2021 at 19:07)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls/near/242243945">said</a>:</p>
<blockquote>
<p>I wouldn't be surprised if it's often just "I need to call a close function and that function can return an error".</p>
</blockquote>
<p>So one example, going back to the Vulkan-like API stuff: "I need to call a close function but I can't call it on my own because I don't have all the data."</p>
<p>Say you have a Device and that can spawn a Pool value. Then, to close the Pool you call <code>close_pool(device, pool)</code>. When you drop a Pool value on its own... well it doesn't store the Device it came from, and so it can't call <code>close_pool</code> on its own.</p>



<a name="242256057"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242256057" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242256057">(Jun 10 2021 at 19:14)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> gankra's blog post on linear types had an interesting suggestion on how to emulate them using closures</p>



<a name="242256149"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242256149" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242256149">(Jun 10 2021 at 19:14)</a>:</h4>
<p><code>with_step1&lt;R, F: FnOnce(Step1Token) -&gt; (R, Step3Token)&gt;(f: F) -&gt; R</code> is the example she gave</p>



<a name="242256260"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242256260" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242256260">(Jun 10 2021 at 19:15)</a>:</h4>
<p>so something like <code>with_pool&lt;R, F: FnOnce(&amp;mut Device, Pool) -&gt; (R, ClosedPool)&gt;(f: F) -&gt; R</code></p>



<a name="242256819"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242256819" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242256819">(Jun 10 2021 at 19:20)</a>:</h4>
<p>hmm, I'm not sure that would work well for graphical API usage. These things are "usually long lived" sorts of things, hopefully for the life of the entire program effectively, though sometimes disaster strikes (eg: the user changes some graphical setting) and you have to tear down and rebuild the world in that rare case.</p>



<a name="242256900"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242256900" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242256900">(Jun 10 2021 at 19:20)</a>:</h4>
<p>and it usually sucks when you have to put the entire rest of your program in a closure</p>



<a name="242257072"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257072" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257072">(Jun 10 2021 at 19:21)</a>:</h4>
<p>sure, but from my perspective having a debug only assert in a drop impl to try and catch potential misuse is also kinda sucky, gotta get that static verification</p>



<a name="242257163"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257163" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257163">(Jun 10 2021 at 19:22)</a>:</h4>
<p>just trying to find alternatives that don't cause UB but still solve the same problem</p>



<a name="242257449"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257449" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257449">(Jun 10 2021 at 19:24)</a>:</h4>
<p>I'm also wondering, what is it specifically  are the downsides of wrapping your whole program in a closure</p>



<a name="242257455"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257455" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257455">(Jun 10 2021 at 19:24)</a>:</h4>
<p>and can we mitigate them?</p>



<a name="242257490"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257490" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257490">(Jun 10 2021 at 19:24)</a>:</h4>
<p>well, if i were writing such a lib myself i'd probably just put in a debug-only message in the Drop impl, maybe use track_caller or whatever and then say "this line dropped me but it shouldn't have"</p>



<a name="242257529"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257529" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257529">(Jun 10 2021 at 19:24)</a>:</h4>
<p>I feel like that's even less likely to get caught before shipping something to prod</p>



<a name="242257567"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257567" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257567">(Jun 10 2021 at 19:25)</a>:</h4>
<p>a debug message?</p>



<a name="242257574"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257574" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257574">(Jun 10 2021 at 19:25)</a>:</h4>
<p>yea</p>



<a name="242257603"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257603" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257603">(Jun 10 2021 at 19:25)</a>:</h4>
<p>unless you're specifically checking the logs for that debug message on all your tests</p>



<a name="242257623"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257623" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257623">(Jun 10 2021 at 19:25)</a>:</h4>
<p>oh, haha, "what tests?"</p>



<a name="242257647"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257647" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257647">(Jun 10 2021 at 19:25)</a>:</h4>
<p>lol</p>



<a name="242257710"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257710" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257710">(Jun 10 2021 at 19:26)</a>:</h4>
<p>this is graphics / gamedev, there's generally no automatic tests, you generally just actually run the program</p>



<a name="242257781"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257781" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257781">(Jun 10 2021 at 19:26)</a>:</h4>
<p>and once the outer "shell" of the program's graphical control flow is set up, there's very rarely a reason to change it</p>



<a name="242257857"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257857" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257857">(Jun 10 2021 at 19:27)</a>:</h4>
<p>I see</p>



<a name="242257886"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257886" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257886">(Jun 10 2021 at 19:27)</a>:</h4>
<p>okay well actually, going back to your comment on using a debug print instead of a panic</p>



<a name="242257935"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242257935" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242257935">(Jun 10 2021 at 19:27)</a>:</h4>
<p>that seems support the idea that we can remove unwinding from drop without completely ruining the workflow for this vulkan API</p>



<a name="242258029"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242258029" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242258029">(Jun 10 2021 at 19:28)</a>:</h4>
<p>oh absolutely, they don't <em>need</em> to be able to panic in drop (as evidenced by the fact that release builds don't)</p>



<a name="242258090"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242258090" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242258090">(Jun 10 2021 at 19:29)</a>:</h4>
<p>wondering what other examples there are of crates who absolutely need to unwind from a panic</p>



<a name="242258266"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242258266" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242258266">(Jun 10 2021 at 19:30)</a>:</h4>
<p>did you mean "need to unwind from a drop"?</p>



<a name="242258563"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242258563" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242258563">(Jun 10 2021 at 19:32)</a>:</h4>
<p>yes</p>



<a name="242258564"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242258564" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242258564">(Jun 10 2021 at 19:32)</a>:</h4>
<p>lol</p>



<a name="242258585"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242258585" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242258585">(Jun 10 2021 at 19:32)</a>:</h4>
<p>the tweet got it right: <a href="https://twitter.com/yaahc_/status/1403072447943827458?s=20">https://twitter.com/yaahc_/status/1403072447943827458?s=20</a></p>
<div class="inline-preview-twitter"><div class="twitter-tweet"><a href="https://twitter.com/yaahc_/status/1403072447943827458?s=20"><img class="twitter-avatar" src="https://uploads.zulipusercontent.net/eeaff3a60f7422ff43d15ea1fba5c17154dd4cc3/68747470733a2f2f7062732e7477696d672e636f6d2f70726f66696c655f696d616765732f313236303734363233383532373332343136322f6f4d4a48724846435f6e6f726d616c2e6a7067"></a><p>So, we ran into a cool bug with `catch_unwind` and are considering making panic in drop unconditionally abort. Now we need to get a better idea of what crates depend on this behavior.

Can anyone think of crates that specifically rely on being able to unwind out of `Drop` impls?</p><span>- Yaah 🦀 (@yaahc_)</span></div></div>



<a name="242258628"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242258628" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242258628">(Jun 10 2021 at 19:33)</a>:</h4>
<p>The <code>yacurses</code> crate <em>very strongly</em> wants to have an unwind occur rather than an abort</p>



<a name="242258656"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242258656" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242258656">(Jun 10 2021 at 19:33)</a>:</h4>
<p>but the worst that happens in the case of an abort is that your terminal is all thrashed up</p>



<a name="242258797"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242258797" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242258797">(Jun 10 2021 at 19:34)</a>:</h4>
<p>but it doesn't trigger the unwind during Drop, it just wants to get dropped instead of forgotten</p>



<a name="242261493"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242261493" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242261493">(Jun 10 2021 at 19:55)</a>:</h4>
<p>Yeah, I think that unlikely bugs introduced by non-unwinding panics in drop could actually always be circumvented by having the caller use an explicit destroying function. Or, in other words, the only cases where this could be required would only need a special/intrinsic/lang dropping function <code>mem::drop_and_catch_unwind()</code> (such a function could be <code>ManuallyDrop::drop</code>). I definitely prefer a targeted opt-in over the current situation, for sure. The more I think about this, the more I agree that applying this change universally should be fine</p>



<a name="242268317"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242268317" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242268317">(Jun 10 2021 at 20:45)</a>:</h4>
<p><span class="user-mention silent" data-user-id="224471">Lokathor</span> <a href="#narrow/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls/near/242125902">said</a>:</p>
<blockquote>
<p>I'm quite honestly baffled at the proposal because I don't see how this can done in a backwards compatible way. Even if it's changed in a new edition then code would have to cope with potentially something from an old edition still being involved.</p>
</blockquote>
<p>I wanna revisit this comment, specifically, in what ways is this a breaking change?</p>



<a name="242268328"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242268328" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242268328">(Jun 10 2021 at 20:45)</a>:</h4>
<p>the one I can think of is that panics in drops that were formerly caught would now take down the application</p>



<a name="242268448"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242268448" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242268448">(Jun 10 2021 at 20:46)</a>:</h4>
<p>this isn't a breaking change from a library perspective because to them panics are already either unwind or abort</p>



<a name="242268532"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242268532" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242268532">(Jun 10 2021 at 20:47)</a>:</h4>
<p>maybe we don't need to worry about this from a perspective of different edition crates linking together, and instead focus on the edition of the binary itself</p>



<a name="242268689"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242268689" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242268689">(Jun 10 2021 at 20:48)</a>:</h4>
<p>so it would be "If the current application is 2021 edition or later and panic = unwind then drops in panics are all aborts"</p>



<a name="242269344"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242269344" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242269344">(Jun 10 2021 at 20:53)</a>:</h4>
<p>one case where i think people could be upset by this is the people who want to replace alloc failure==abort with alloc failure==panic. of course, this isn't really breaking, since this isn't a supported configuration at all</p>



<a name="242269512"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242269512" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242269512">(Jun 10 2021 at 20:54)</a>:</h4>
<p>even if you compile as panic=unwind though, in general you can't really expect a panic in Drop to always unwind even today, since it will abort if you panic in a drop when already unwinding</p>



<a name="242270060"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242270060" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242270060">(Jun 10 2021 at 20:59)</a>:</h4>
<p>one other downside is that crates with this in their drop (imagine <code>some_error</code> is something like an IO error during close)</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">if</span><span class="w"> </span><span class="fm">cfg!</span><span class="p">(</span><span class="n">debug_assertions</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="fm">panic!</span><span class="p">(</span><span class="s">"error with blah: {:?}"</span><span class="p">,</span><span class="w"> </span><span class="n">some_error</span><span class="p">);</span><span class="w"></span>
<span class="p">}</span><span class="w"> </span><span class="k">else</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">log</span>::<span class="n">error</span><span class="o">!</span><span class="p">(</span><span class="s">"error with blah: {:?}"</span><span class="p">,</span><span class="w"> </span><span class="n">some_error</span><span class="p">);</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>will probably start failing to report a useful message. or at least, the current "nevermind, just abort" behavior under panic=unwind doesn't report the message to anything, iirc.</p>



<a name="242270687"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242270687" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242270687">(Jun 10 2021 at 21:03)</a>:</h4>
<p>even with an aborting panic the panic hook still runs so you still get your error output</p>



<a name="242273659"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242273659" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242273659">(Jun 10 2021 at 21:27)</a>:</h4>
<p><span class="user-mention silent" data-user-id="220273">Jane Lusby</span> <a href="#narrow/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls/near/242268317">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="224471">Lokathor</span> <a href="#narrow/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls/near/242125902">said</a>:</p>
<blockquote>
<p>...</p>
</blockquote>
<p>I wanna revisit this comment, specifically, in what ways is this a breaking change?</p>
</blockquote>
<p>Because (to quote the issue) "decide at the language level to generally not allow unwind from Drop impls" without any further clarification sounds like "it's now a build error" or "it's not a build error but it's UB".</p>



<a name="242274543"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242274543" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242274543">(Jun 10 2021 at 21:36)</a>:</h4>
<p><span class="user-mention silent" data-user-id="220273">Jane Lusby</span> <a href="#narrow/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls/near/242270687">said</a>:</p>
<blockquote>
<p>even with an aborting panic the panic hook still runs so you still get your error output</p>
</blockquote>
<p>This is true for panic=abort, but at least currently, under panic=unwind, when an aborting panic is performed it's a "hard" abort, e.g. core::intrinsics::abort, no hook called. Would this be different?</p>



<a name="242274664"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242274664" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242274664">(Jun 10 2021 at 21:36)</a>:</h4>
<p>hooks are a libstd thing, not a language one. So two somewhat different domains. I imagine in that respect panics within drops would either not call any hooks, or once they are invoked (and their hooks run) caught and cause an abort.</p>



<a name="242275419"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242275419" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242275419">(Jun 10 2021 at 21:44)</a>:</h4>
<p>Hm, actually now that I think about it, the panic strategy implementation would be able to decide however it wants to implement the panic in the drop glue.</p>



<a name="242276598"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242276598" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242276598">(Jun 10 2021 at 21:56)</a>:</h4>
<p>and i bet <code>core::intrinsics::abort</code> can UB on some embedded targets if the program counter doesn't have anywhere to go to.</p>



<a name="242281537"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242281537" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242281537">(Jun 10 2021 at 22:49)</a>:</h4>
<p>I do have a question for this:<br>
If you panic in drop, and catch_unwind it before it escapes the drop, would it still abort (assuming it's not rethrown)?</p>



<a name="242283731"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242283731" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242283731">(Jun 10 2021 at 23:17)</a>:</h4>
<p>I can't imagine how that could possibly abort; the panic/catch might well be in a function called by drop</p>



<a name="242286584"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242286584" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christopher Durham <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242286584">(Jun 11 2021 at 00:01)</a>:</h4>
<p>What I worry about is that a nonuniversal (opt-out, edition-in, w/e) change is basically no better than no change for library code. Library code still has to handle the case where a caught panic payload panics on drop. So the footgun is still there, just mitigated in the common case (the payload drop aborting rather than panicking). (Good) Library code still has to be written under the assumption that a caught unwind payload could panic on drop.</p>
<p>On the other hand, I _highly_ doubt that anyone is using the fact that they can unwind from the drop code of a panic payload, and have it "work". While the first layer of drop code unwinding is reasonable enough (for e.g. fault tolerant runtimes catching and aborting just the task/thread that failed, not the entire process), the second panic _feels_ like a panic-in-panic that should cause an abort. Dtolnay's posted what seems like a clean implementation strategy for converting the payload's drop code to be aborting rather than unwinding, so it's at least feasible.</p>
<p>I think I would (theoretically) prefer in general if drop code was guaranteed not to unwind, via an abort-at-edge like <code>extern "C"</code> functions are planned to. All existing panics in drops are potential aborts already, and as I understand it, it would make lib and generated code simpler to not have to handle that case. (Lib code that would still have to handle it in the usually-but-not-always abort case.) I just worry about changing this breaking stability, and for what's even technically not a language soundness issue, but "just" a (common) stdlib footgun that commonly leads to soundness issues in libraries. Thus fixing <code>catch_unwind</code> feeling like the "correct" choice to me.</p>
<p>One final thing worth noting, though, is that forcing an abort for panics in (unwind payload) drop impls prevents the "smoothest" solution: <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=42f7dfad88f4a4f664f4e9adc474fe36">attempt to drop the payload, then leak it if you can't</a>. (This would miss the case of a finite stack of panicking unwind payloads, but that's pretty clearly even _more_ degenerate.) This _could_ be accomplished by a replacement function that returns a custom error type (e.g. <code>UnwindPayload</code>) that wraps <code>Box&lt;dyn Any + Send + 'static&gt;</code> and implements the drop-or-leak semantics.</p>



<a name="242286820"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242286820" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christopher Durham <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242286820">(Jun 11 2021 at 00:05)</a>:</h4>
<p>That's a big message, so TL;DR I'm against making <code>Drop::drop</code> abort when a panic escapes if it only happens less than always (when compiling with rustc &gt;= 1.Future), but would be for either making it abort always (not configurable) or making <code>catch_unwind</code> (or its replacement) suppress the unwind of the caught unwind payload (via leak or abort).</p>



<a name="242287373"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242287373" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christopher Durham <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242287373">(Jun 11 2021 at 00:13)</a>:</h4>
<p>Also, it's worth noting that making it abort-at-edge would trivially make the panic in the drop behave normally and call the hook, since it would still unwind from the throw to the catch-and-abort edge. I would be against making panic-in-drop an instant panic-in-panic style give-up-abort, since that would prevent the use of <code>catch_unwind</code> to prevent the abort. (<code>catch_unwind</code> doesn't currently work to prevent panic-in-panic aborts, but it does work to prevent drop from panicking in the first place.)</p>



<a name="242287480"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242287480" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242287480">(Jun 11 2021 at 00:15)</a>:</h4>
<p><span class="user-mention" data-user-id="132829">@Christopher Durham</span> You make a fair point; while I'd <em>like</em> to just disallow unwind from drop in <em>all</em> cases, it may be more tenable to just disallow unwind from the drop of a panic payload, which is probably something ~nobody is using.</p>



<a name="242307552"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242307552" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Frank Steffahn <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242307552">(Jun 11 2021 at 06:59)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span> How does that work? Turn panics into abort for destructors of values that are panic payloads? How does the value's <code>drop</code> method know, at runtime, whether it has been (part of?) a panic payload?</p>



<a name="242314558"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242314558" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> The 8472 <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242314558">(Jun 11 2021 at 08:24)</a>:</h4>
<p>The payloads are boxed as dyn traits. The proposed approach was to substitute the vtable.</p>



<a name="242320309"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242320309" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242320309">(Jun 11 2021 at 09:24)</a>:</h4>
<p>Rustc uses a panicking drop impl to ensure that every <code>Diagnostic</code> is either emitted or canceled. If the panic turned into an abort, that would mean that rls crashes if a <code>Diagnostic</code> gets dropped. While for rls I guess it would be fine for the user to restart it, what about if something like this is done in a web server? A panic there should most of the time only cancel the current request (returning a 500 internal server error to the user) and not bring down the whole server as an abort would.</p>



<a name="242321149"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242321149" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242321149">(Jun 11 2021 at 09:32)</a>:</h4>
<p>A while ago I also saw an OS that used rust for software isolation. When a process crashed (panicked or a segv), it would unwind the stack and run all destructors to release resources back to the os. Aborting on panic would either bring down the whole system or unwind anyway.</p>



<a name="242336949"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242336949" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242336949">(Jun 11 2021 at 12:23)</a>:</h4>
<p>Panicking in a drop will most likely leak memory, which is something that you really don't want in a web server.</p>



<a name="242354172"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242354172" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Kestrer <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242354172">(Jun 11 2021 at 14:37)</a>:</h4>
<p>FWIW: My crate <code>with-str-bytes</code> would be broken by this change, although I could easily fix it. What it does is makes use of a guard to check that invariants have not been broken after running a closure, fixing the invariants <a href="https://github.com/Kestrer/with-str-bytes/blob/master/src/lib.rs#L56">and panicking</a> if they have been. I am not sure how prevalent this pattern is across the ecosystem though.</p>



<a name="242358095"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242358095" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242358095">(Jun 11 2021 at 15:06)</a>:</h4>
<p><span class="user-mention" data-user-id="360486">@Kestrer</span> this seems like a good use case for my suggested opt-out (<em>e.g.</em>, <code>.drop_and_catch_unwind()</code>).</p>
<p>That being said, for your very example, you could also move the <code>else</code> logic from the drop body directly into <a href="https://github.com/Kestrer/with-str-bytes/blob/c297c835327b986423f0bd2aadda884c437dba48/src/lib.rs#L66">https://github.com/Kestrer/with-str-bytes/blob/c297c835327b986423f0bd2aadda884c437dba48/src/lib.rs#L66</a>, and everything would Just Work™</p>



<a name="242359132"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242359132" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> The 8472 <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242359132">(Jun 11 2021 at 15:13)</a>:</h4>
<p>Is that panic meant to inform the developer of a programming error or is the idea that this can occasionally happen during runtime? If it is the former then turning the panic into an abort would still be fine, no?</p>



<a name="242363057"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242363057" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242363057">(Jun 11 2021 at 15:41)</a>:</h4>
<p>A panic is only supposed to be used for a programming error or highly unlikely errors. If the error is expected it should be an <code>Result</code>. Depending on the kind of program you have you just may want to catch panics and gracefully fail by for example giving an error for a single http request or only crash a single tab in a browser. Aborting should only happen when it is no longer possible to continue without risking memory safety issues or other security issues.</p>
<p>expected to sometimes happen: <code>Result</code><br>
recoverable highly unlikely or programming error: <code>panic!()</code><br>
unrecoverable in any way: <code>process::abort()</code></p>



<a name="242364628"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242364628" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> The 8472 <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242364628">(Jun 11 2021 at 15:52)</a>:</h4>
<p>Yeah, my question was whether the examples given so far fall under the "highly unlikely" vs. "programming error" category.</p>



<a name="242456128"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242456128" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242456128">(Jun 12 2021 at 15:21)</a>:</h4>
<p><span class="user-mention silent" data-user-id="224471">Lokathor</span> <a href="#narrow/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls/near/242258797">said</a>:</p>
<blockquote>
<p>but it doesn't trigger the unwind during Drop, it just wants to get dropped instead of forgotten</p>
</blockquote>
<p>I dont think there is any proposal to change that? This thread is specifically about triggering the unwind (calling <code>panic!</code>) during Drop</p>



<a name="242456144"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242456144" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242456144">(Jun 12 2021 at 15:21)</a>:</h4>
<p><span class="user-mention silent" data-user-id="224471">Lokathor</span> <a href="#narrow/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls/near/242276598">said</a>:</p>
<blockquote>
<p>and i bet <code>core::intrinsics::abort</code> can UB on some embedded targets if the program counter doesn't have anywhere to go to.</p>
</blockquote>
<p>that would be a wrong implementation, AFAIK <code>abort</code> is a safe intrinsic these days. It is certainly treated as such by libstd.<br>
embedded targets can always <code>loop {}</code>.</p>



<a name="242456919"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242456919" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242456919">(Jun 12 2021 at 15:37)</a>:</h4>
<p>Right, I know Ralf. I'm saying "the closest I can think of is X, even though that isn't the same".</p>



<a name="242457168"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242457168" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242457168">(Jun 12 2021 at 15:43)</a>:</h4>
<p>Also, as to <code>abort</code>:</p>
<ul>
<li><code>core::intrinsics::abort</code> is unsafe and unstable.</li>
<li><code>std::process::abort</code> is safe and stable.</li>
</ul>



<a name="242460957"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242460957" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242460957">(Jun 12 2021 at 17:00)</a>:</h4>
<blockquote>
<p>core::intrinsics::abort is unsafe and unstable.</p>
</blockquote>
<p>That's what I am saying: this is wrong.<br>
<code>intrinsics::abort</code> is <a href="https://github.com/rust-lang/rust/blob/003b8eadd7a476c51956fe447894532d6e21937e/compiler/rustc_typeck/src/check/intrinsic.rs#L59">safe</a> (and unstable).</p>



<a name="242462037"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242462037" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242462037">(Jun 12 2021 at 17:29)</a>:</h4>
<blockquote>
<p>/// Returns <code>true</code> if the given intrinsic is unsafe to call or not.<br>
pub fn intrinsic_operation_unsafety(intrinsic: Symbol) -&gt; hir::Unsafety {</p>
</blockquote>
<p>what a trigger huh</p>



<a name="242465793"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242465793" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242465793">(Jun 12 2021 at 18:57)</a>:</h4>
<p>Well, I'm just saying what the standard library calls it. They're the ones calling it unsafe.</p>



<a name="242465859"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242465859" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242465859">(Jun 12 2021 at 18:58)</a>:</h4>
<p>I really don't know how you'd even actually implement a general core abort, is one thing.</p>



<a name="242465904"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242465904" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242465904">(Jun 12 2021 at 18:59)</a>:</h4>
<p>like, a good one i mean</p>



<a name="242466364"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242466364" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242466364">(Jun 12 2021 at 19:08)</a>:</h4>
<p>I'd do it by going through the panic handler with a special flag in <code>PanicInfo</code> which tells the handler to always abort instead of unwind.</p>



<a name="242466455"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242466455" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242466455">(Jun 12 2021 at 19:10)</a>:</h4>
<p>That wouldn't work for</p>
<div class="codehilite"><pre><span></span><code>fn drop() {
    panic::catch_unwind(move || { ... })
}
</code></pre></div>
<p>though.</p>



<a name="242466460"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242466460" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242466460">(Jun 12 2021 at 19:10)</a>:</h4>
<p>Or would it…</p>



<a name="242466472"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242466472" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242466472">(Jun 12 2021 at 19:11)</a>:</h4>
<p>I don't see the problem?</p>



<a name="242466558"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242466558" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242466558">(Jun 12 2021 at 19:12)</a>:</h4>
<p>So you either make panics in the <code>catch_unwind</code> panic (i.e. the behaviour of passing a special flag transitive somehow), or other arbitrary functions called by drop don't inherit the aborting behaviour if they're called from <code>drop</code>, right?</p>



<a name="242466572"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242466572" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242466572">(Jun 12 2021 at 19:13)</a>:</h4>
<p>And making this extend to the functions called by <code>drop</code>s sound like pain.</p>



<a name="242466574"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242466574" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242466574">(Jun 12 2021 at 19:13)</a>:</h4>
<p>Basically the drop function has an invisible landing pad that calls <code>core::unwind_out_of_drop_handler</code>. Which would then call the <code>panic_handler</code> with a flag that says to abort immediately instead of unwind.</p>



<a name="242466830"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242466830" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242466830">(Jun 12 2021 at 19:17)</a>:</h4>
<p>I might be confusing the temporal order of when specific things exist and happen, I guess, because my understanding is that our unwinding implementation does not allow for deciding which landing pads will be executed before unwinding is invoked (and we invoke panic hooks before that, I think?).</p>



<a name="242466908"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242466908" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242466908">(Jun 12 2021 at 19:18)</a>:</h4>
<p>But I would definitely push for it to be implemented in a pretty similar manner – the same way we implement the guard for unwinding out of <code>extern "C"</code> functions.</p>



<a name="242467033"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242467033" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242467033">(Jun 12 2021 at 19:20)</a>:</h4>
<p>We already have a perfect place for it too – there's always some drop glue that invokes the <code>Drop::drop</code> hook. Would fit in there pretty easily.</p>



<a name="242468379"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242468379" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242468379">(Jun 12 2021 at 19:48)</a>:</h4>
<p>The temporal order would look like this:</p>
<ol>
<li>First panic which starts unwinding.</li>
<li>Second panic inside a drop while unwinding.</li>
<li>Third panic in the drop glue which forces an abort.</li>
</ol>



<a name="242471022"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242471022" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christopher Durham <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242471022">(Jun 12 2021 at 20:31)</a>:</h4>
<p>That's definitely not how it works currently. (Or you've misspoke sightly about order.) Currently, if you are <code>thread::panicking()</code>, causing a panic causes an immediate abort (before printing a message). This behavior is _not_ changed if you enter a <code>catch_unwind</code> landing pad.</p>



<a name="242471728"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242471728" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Christopher Durham <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242471728">(Jun 12 2021 at 20:47)</a>:</h4>
<p>My understanding of the specific problematic case is:</p>
<ol>
<li>Some unwind is caught by <code>catch_unwind</code>.</li>
<li>The unwind payload is dropped.</li>
<li>Whoops, the unwind payload panics on drop!</li>
<li>The unwind continues through the stack that was catching the prior unwind.</li>
</ol>
<p>The general approach of preventing unwinds from escaping drop code:</p>
<ol>
<li>Some unwind is caught by <code>catch_unwind</code>.</li>
<li>The unwind payload is dropped.</li>
<li>
<p>In the drop glue, a <code>catch_unwind</code> landing pad is created. </p>
<ul>
<li>(For minimal overhead, just one at the base, not for each transitive <code>drop_in_place</code>. I think this is equivalent to providing one for each <code>drop_in_place</code>, modulo knowing which type's drop glue panicked without the stacktrace?)</li>
</ul>
</li>
<li>
<p>If that <code>catch_unwind</code> catches an unwind, cause an abort.</p>
</li>
</ol>
<p>The minimal, targeted approach of preventing just the above problem case:</p>
<ol>
<li>Some unwind is caught by <code>catch_unwind</code>.</li>
<li>The vtable of the caught payload is changed, such that the <code>drop_in_place</code> pointer is adjusted to an unwind-to-abort wrapped version.</li>
<li>The unwind payload is dropped.</li>
<li>The first thing the wrapped drop code does is set <code>thread::panicking</code>.</li>
<li>The real drop code is called, causing a panic-while-panicking.</li>
<li>(If the destructor ran successfully, reset <code>thread::panicking</code>.)</li>
</ol>
<p>Or, alternatively, the targeted solution could use a landing pad like the general solution described. I personally would like the panic-while-panicking behavior to be handled via a landing pad as well, rather than immediate abort, such that <code>catch_unwind</code> would work while already unwinding, but understand this might raise some new questions w.r.t. unwind safety, since panic-while-panicking would now cause an unwind rather than an immediate abort.</p>
<p>Or, as a final option, add another flag for "in unwind payload destructor" separate from "currently unwinding," and let the panic handler handle it somehow.</p>



<a name="242473124"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242473124" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242473124">(Jun 12 2021 at 21:18)</a>:</h4>
<p>I don't think panic payloads panicking is a problem in context of disallowing unwinding from Drop.</p>



<a name="242473139"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242473139" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242473139">(Jun 12 2021 at 21:19)</a>:</h4>
<p>Since we'll be aborting anyway, there's no reason for us to bother running <code>Drop</code> for the panic payload in the first place – Rust doesn't guarantee that we drop things after all.</p>



<a name="242498535"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242498535" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242498535">(Jun 13 2021 at 08:37)</a>:</h4>
<p><span class="user-mention silent" data-user-id="224471">Lokathor</span> <a href="#narrow/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls/near/242465793">said</a>:</p>
<blockquote>
<p>Well, I'm just saying what the standard library calls it. They're the ones calling it unsafe.</p>
</blockquote>
<p>they are not... or I am totally misunderstanding what you mean here.</p>



<a name="242498539"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242498539" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242498539">(Jun 13 2021 at 08:37)</a>:</h4>
<p><span class="user-mention silent" data-user-id="123586">nagisa</span> <a href="#narrow/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls/near/242462037">said</a>:</p>
<blockquote>
<blockquote>
<p>/// Returns <code>true</code> if the given intrinsic is unsafe to call or not.<br>
pub fn intrinsic_operation_unsafety(intrinsic: Symbol) -&gt; hir::Unsafety {</p>
</blockquote>
<p>what a trigger huh</p>
</blockquote>
<p>yeah, I already submitted a PR to fix the comment^^</p>



<a name="242520464"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242520464" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242520464">(Jun 13 2021 at 17:04)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls/near/242498535">said</a>:</p>
<blockquote>
<p>or I am totally misunderstanding what you mean here.</p>
</blockquote>
<p>I'm saying that <a href="https://doc.rust-lang.org/core/intrinsics/fn.abort.html">core::intrinsics::abort</a>, in the standard library, has a signature of:</p>
<div class="codehilite"><pre><span></span><code>pub unsafe extern &quot;rust-intrinsic&quot; fn abort() -&gt; !
</code></pre></div>
<p>And thus, it is unsafe.</p>
<p>If it's safe internally in the HIR, that's a different matter.</p>



<a name="242520564"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242520564" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242520564">(Jun 13 2021 at 17:06)</a>:</h4>
<p>That is a rustdoc issue. This compiles fine:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="cp">#![feature(core_intrinsics)]</span><span class="w"></span>

<span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">std</span>::<span class="n">intrinsics</span>::<span class="n">abort</span><span class="p">();</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="242520566"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242520566" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242520566">(Jun 13 2021 at 17:06)</a>:</h4>
<p>Hence the misunderstanding: I think that <code>::core</code> reporting that instrinsic function as <code>unsafe</code> is a rustdoc bug. EDIT: what <span class="user-mention" data-user-id="133247">@bjorn3</span> said (<a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=16c0888e90ea186e4513e2984fd85c12">playground</a>)</p>



<a name="242589054"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242589054" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242589054">(Jun 14 2021 at 12:31)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> </p>
<blockquote>
<p>core::intrinsics::abort, in the standard library, has a signature of</p>
</blockquote>
<p>it doesn't, that's what I keep saying. ;)</p>



<a name="242590276"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242590276" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Chris Denton <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242590276">(Jun 14 2021 at 12:43)</a>:</h4>
<p>Weirdly, it does in the docs: <a href="https://doc.rust-lang.org/nightly/core/intrinsics/fn.abort.html">https://doc.rust-lang.org/nightly/core/intrinsics/fn.abort.html</a></p>
<p>All the intrinsics are unsafe.</p>



<a name="242590448"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242590448" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242590448">(Jun 14 2021 at 12:44)</a>:</h4>
<p><span class="user-mention silent" data-user-id="133247">bjorn3</span> <a href="#narrow/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls/near/242520564">said</a>:</p>
<blockquote>
<p>That is a rustdoc issue.</p>
</blockquote>



<a name="242590559"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242590559" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242590559">(Jun 14 2021 at 12:45)</a>:</h4>
<p>Intrinsics are defined using <code>extern "rust-intrinsic" { ... }</code>. Functions defined in <code>extern</code> blocks are normally always unsafe. Typeck however has a hardcoded list of safe intrinsics. Rustdoc likely doesn't know about this list.</p>



<a name="242650762"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242650762" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242650762">(Jun 14 2021 at 19:53)</a>:</h4>
<p>I've filed a PR to clarify in the docs that certain intrinsics are not unsafe to call: <a href="https://github.com/rust-lang/rust/pull/86308">https://github.com/rust-lang/rust/pull/86308</a></p>



<a name="242767510"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Never%20allow%20unwinding%20from%20Drop%20impls/near/242767510" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lqd <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Never.20allow.20unwinding.20from.20Drop.20impls.html#242767510">(Jun 15 2021 at 17:17)</a>:</h4>
<p>the rustdoc issue will be fixed by <a href="https://github.com/rust-lang/rust/pull/86327">https://github.com/rust-lang/rust/pull/86327</a></p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>